On Tue, Apr 21, 2020 at 1:10 PM Tiemen Ruiten <t.ruiten(a)tech-lab.io> wrote:
Hello,
On Tue, Apr 21, 2020 at 12:46 PM François Cami <fcami(a)redhat.com> wrote:
> Hi,
>
> On Tue, Apr 21, 2020 at 12:19 PM Tiemen Ruiten via FreeIPA-users
> <freeipa-users(a)lists.fedorahosted.org> wrote:
> >
> > Hello,
> >
> > Since a few days ago, we're having issues with resolution of this
> hostname:
> >
> > download.wisselkoersenvoorjeadministratie.nl
> >
> > Our FreeIPA DNS servers return SERVFAIL for that particular hostname.
> What's funny, after I do a (successful) lookup directly at one of the
> configured forwarders, 1.1.1.1, resolution works, until the TTL expires.
> Other hostnames work fine. How can I troubleshoot this?
>
> Please have a look at the logs:
>
https://www.freeipa.org/page/Troubleshooting/DNS#Getting_logs
> There should be some entry at the time you reproduce the issue.
>
No lines related to named in /var/log/messages.
I set debug logging with 'rndc trace' on the IPA nameserver that's being
queried and this shows up in named.run when I query the hostname:
21-Apr-2020 13:07:37.912 fetch:
download.wisselkoersenvoorjeadministratie.nl/A
21-Apr-2020 13:07:37.939 client @0x7fcee8031200 10.100.120.47#36751 (
download.wisselkoersenvoorjeadministratie.nl): query failed (SERVFAIL)
for download.wisselkoersenvoorjeadministratie.nl/IN/A at
../../../bin/named-pkcs11/query.c:8580
Added debug level 3, here's a failed lookup and a successful one (after
lookup @1.1.1.1):
[root@ipa-ams-02 ter]# tail -f /var/named/data/named.run | grep
wisselkoersen
21-Apr-2020 13:16:21.397 client @0x7fcef1c8d350 10.100.120.47#35525 (
download.wisselkoersenvoorjeadministratie.nl): query (cache) '
download.wisselkoersenvoorjeadministratie.nl/A/IN' approved
21-Apr-2020 13:16:21.397 client @0x7fcef1c8d350 10.100.120.47#35525 (
download.wisselkoersenvoorjeadministratie.nl): replace
21-Apr-2020 13:16:21.398 fetch:
download.wisselkoersenvoorjeadministratie.nl/A
21-Apr-2020 13:16:21.421 client @0x7fcef1c8d350 10.100.120.47#35525 (
download.wisselkoersenvoorjeadministratie.nl): query failed (SERVFAIL) for
download.wisselkoersenvoorjeadministratie.nl/IN/A at
../../../bin/named-pkcs11/query.c:8580
21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (
download.wisselkoersenvoorjeadministratie.nl): error
21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (
download.wisselkoersenvoorjeadministratie.nl): send
21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (
download.wisselkoersenvoorjeadministratie.nl): sendto
21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (
download.wisselkoersenvoorjeadministratie.nl): senddone
21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (
download.wisselkoersenvoorjeadministratie.nl): next
21-Apr-2020 13:16:21.422 client @0x7fcef1c8d350 10.100.120.47#35525 (
download.wisselkoersenvoorjeadministratie.nl): endrequest
21-Apr-2020 13:16:21.422 fetch completed at
../../../lib/dns-pkcs11/resolver.c:3754 for
download.wisselkoersenvoorjeadministratie.nl/A in 0.023506:
SERVFAIL/success [domain:wisselkoersenvoorjeadministratie.nl
,referral:0,restart:2,qrysent:2,timeout:0,lame:0,quota:0,neterr:0,badresp:2,adberr:0,findfail:0,valfail:0]
^C
[root@ipa-ams-02 ter]# tail -f /var/named/data/named.run | grep
wisselkoersen
21-Apr-2020 13:17:15.389 client @0x7fcef000c580 10.100.120.47#40143 (
download.wisselkoersenvoorjeadministratie.nl): query (cache) '
download.wisselkoersenvoorjeadministratie.nl/A/IN' approved
21-Apr-2020 13:17:15.389 client @0x7fcef000c580 10.100.120.47#40143 (
download.wisselkoersenvoorjeadministratie.nl): replace
21-Apr-2020 13:17:15.389 fetch:
download.wisselkoersenvoorjeadministratie.nl/A
21-Apr-2020 13:17:15.403 fctx 0x7fcee981b0d0(
download.wisselkoersenvoorjeadministratie.nl/A): looking for relevant NSEC3
21-Apr-2020 13:17:15.403 fctx 0x7fcee981b0d0(
download.wisselkoersenvoorjeadministratie.nl/A): NSEC3 proves name does not
exist: 'download.wisselkoersenvoorjeadministratie.nl'
21-Apr-2020 13:17:15.403 fctx 0x7fcee981b0d0(
download.wisselkoersenvoorjeadministratie.nl/A): NSEC3 indicates secure
range
21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (
download.wisselkoersenvoorjeadministratie.nl): send
21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (
download.wisselkoersenvoorjeadministratie.nl): sendto
21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (
download.wisselkoersenvoorjeadministratie.nl): senddone
21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (
download.wisselkoersenvoorjeadministratie.nl): next
21-Apr-2020 13:17:15.403 client @0x7fcef000c580 10.100.120.47#40143 (
download.wisselkoersenvoorjeadministratie.nl): endrequest